Extracted

• • Target
    BaseWare Loader.bat
  • Size 24.7MB
  • SHA256 efb6dacc94774f0f9e6405e5fc491aaedc4dde5c365cf845791f0dfec7f42d9c
  • MD5 d3e4e23b89711cd9b20ad64fb6a7897b
  • SHA1 ac4370d2c29a60247dc33128446f4a58fb2cca91
  • SHA512 f95aed04a7713c2d548297e2e5a472f4d5cb577eb4c75d00056c7ea28fe31b41a38c331a2399240504f93780cb33f5fa3beb474f07a0081854199c90f12a859e
  • SSDEEP 49152:33apmXVOBciH3YngdN/5kAltt71pZp1lMkznvQQ5WejfoESD9kfVx6pBq6+6Wvrq:1
  • TLSH
    T1DD4733209F6A6EBE8A9C833C707F2F1E1AA10FD48448E5EA4BF0A4C7155DB41485FD6D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionluna_stealerxwormpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupxadwareransomware

  • Detect Xworm Payload

  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2